Password Generator
Generate strong, secure random passwords
qA]L]D$[*ZLD]Hd216 characters, each one of 88 possible characters: 16 x log2(88) = 103.4 bits.
Requiring every chosen type to appear rules out some passwords, so the exact figure is 103.1 bits (log2 of the 10,922,066,122,218,054,169,310,944,296,960 passwords that qualify).
At 10 billion guesses a second, an attacker would need on average over a trillion years (the universe is about 13.8 billion years old) to reach this one.
What the crack time assumes
Assumes an attacker trying 10 billion guesses a second against a fast-hashed copy of the password and getting there after trying half of all possibilities. A site that stores passwords with a slow hash (bcrypt, Argon2) is far slower to attack; a site that leaks them in plain text makes this number meaningless. It holds only for a password drawn at random like this one: a password you edit, reuse or recognise from a breach is not covered. Entropy measures how hard a password is to guess, not whether it is safe to reuse: use a different password for every account.
Made in this browser with crypto.getRandomValues (your device's secure random source, with no bias towards any character). It is never sent anywhere and never stored: leave the page and it is gone.
At least one character type must stay on.
Already have a password and want to know how it holds up? Check its strength, which looks for common words, names, keyboard runs and repeats. This page makes new ones.
About Password Generator
Generates a random, secure password of a length and character set you choose, for use with a new account or to replace a weak existing password — a genuinely random password is one you couldn't have guessed yourself, which is exactly what makes it harder for anyone else to guess too.
A password appears as soon as the page opens. Set the length and which character types to include (uppercase, lowercase, numbers, symbols), or switch to a passphrase of random words, then press Generate for a new one. The entropy line shows the arithmetic behind the strength. Copying a password takes one of your trial uses for the visit; seeing it does not.
Longer passwords are generally more secure than shorter ones with more symbol complexity — a 16-character password of mixed letters and numbers is often stronger than a 10-character one packed with symbols, since password strength grows much faster with length than with character variety. Check it against Password Strength afterward if you want a real cracking-time estimate rather than just trusting length alone.
Watch: Password Generator in Action
- Is a longer password really more secure than a complex one?
- Generally yes — a 16-character password of mixed letters and numbers is often stronger than a 10-character one packed with symbols, since password strength grows much faster with length than with character variety.
- How random are the passwords it creates?
- Each character is chosen with crypto.getRandomValues, your browser's cryptographic random source, using a method that avoids bias toward the first characters of a set. If a chosen type (say, a digit) is missing, the whole password is drawn again, so every password that qualifies is equally likely. Ordinary Math.random is not used anywhere in the process.
- What does the entropy figure mean?
- Entropy in bits measures how hard a secret is to guess, doubling with every extra bit. For a password it starts from length times the base-2 logarithm of the number of possible characters, then takes off the passwords your settings rule out (for example, ones with no digit), and the page shows both numbers. The labels are Weak under 45 bits, Medium from 45, Strong from 70 and Very Strong from 100. The crack time beside it assumes 10 billion guesses a second against a fast-hashed copy; it is an estimate for a password drawn at random like this one, not a promise, and it says nothing about a password you reuse or that has leaked.
- Should I choose a password or a passphrase?
- A passphrase is easier to type and remember. Five words from the 7,776-word list plus the added number come to about 74 bits. The default 16-character password with all four groups comes to about 103 bits, but it really needs a password manager.
- Can I stop symbols that a website rejects?
- You can. With Symbols switched on, an Allowed symbols box appears holding the default set. Delete any character the site refuses, or type your own list. If you empty it, the default set is used again, so switch Symbols off to remove them completely.
- Is my password sent anywhere, or does it use up a trial use to see one?
- It is made in your browser and never sent or stored. The only download is the word list for passphrases. A password appears when the page opens and each time you press Generate, without using a trial use; copying one takes a trial use for the visit.
- What is the difference between this page and Password Generator & Checker?
- This page makes new passwords and passphrases, with the entropy maths. The Password Generator & Checker is for pasting in a password you already have and seeing how it holds up against common words, names, keyboard runs and repeats. Each page links to the other.
- Does the tool keep a history of what it generated?
- History is not kept. Results sit only in the open page and are replaced when you press Generate again, and switching between Password and Passphrase clears them. Nothing is stored for later, so copy a result before you leave or reload the page.
How to use Password Generator
Pick a type with the two buttons at the top: Password or Passphrase (words). For a password, drag the Length slider anywhere from 4 to 64, then switch on the groups you want: Uppercase, Lowercase, Numbers and Symbols. Another switch leaves out look-alike characters such as I, l, 1, O and 0. If a website rejects certain symbols, delete them in the Allowed symbols box.
For a passphrase, set Words from 3 to 10, choose a Separator, and decide whether to capitalise the words or add a number. The How many menu offers 1, 3, 5 or 10 results. Press Generate, then use Copy beside a result. Hide masks the text if someone is watching your screen. Under the results you will see a strength label, the bits of entropy and an offline cracking-time estimate.
When to use it
Use it when you are opening a new account and want a secret you could never invent yourself, when a reset page forces you to change a weak one, or when you are filling a password manager with distinct entries. Passphrase mode suits a master password or a Wi-Fi key that you must type by hand on a phone.
When not to use it
Do not generate a password unless you have somewhere safe to keep it. A password manager is the right companion, because a random 20-character string is not something to memorise. Where a service offers a passkey or a hardware security key, that is a stronger choice than any secret you type, and it removes the need for a password entirely.
Tips for best results
If a site demands a digit and a symbol, leave all four groups on. The generator draws the whole password from the pool and starts again if a selected group is missing, so the rule is always met and every qualifying password is equally likely. Trim the Allowed symbols box instead of turning symbols off, and pick a space or hyphen separator for phrases you will read aloud.
Limitations
The cracking-time figure assumes ten billion guesses per second against a fast offline hash and takes the average case, so real attackers and slower hashes will differ. Entropy is computed from the number of passwords your settings allow, which is only valid because the password is drawn at random; a password you edit by hand, reuse or find in a breach is not covered. Length is capped at 64 and passphrases at 10 words. Passphrase mode needs its word list to download the first time.
Privacy
Passwords are built in your browser with the Web Crypto random generator and exist only on the page until you copy them or close it. They are not sent to the site. Passphrase mode downloads a public word list file from this site, which is a request for the list and not for your result. A usage count is recorded when you copy a password, not when one is shown.
More from Security & Developer: